"Usually" is not the word. I don't buy Nubits anymore. I used to buy and sell at Bittrex. But then I would hold it in a wallet where the keys are on my device. There was a time when Bittrex wouldn't let me withdraw. They held coins at ransom and wouldn't release them until users revealed their identities. Even after that some were not able to withdraw their coins.

So, now I use Shape-shift and Changelly and to some extent Blocktrades. These are exchanges that send you what you buy as soon as they get their coins. Which means they do not hold any coins on behalf of their users.